connector: resolve Slack user group mention handles

[0x-chad]

Built on #91. Until #91 merges, GitHub shows both commits in this PR; after it merges, this PR becomes the resolver-only follow-up.

What this adds

• Lazily calls usergroups.list only when an unlabeled user-group mention must be resolved.
• Shares a workspace-wide handle cache between mrkdwn and rich-text block conversion.
• Refreshes the cache after one hour so renamed, added, and removed groups are picked up.
• Bounds API calls to 10 seconds, backs off failed refreshes for one minute, and retains stale handles when Slack is temporarily unavailable.
• Falls back to the visible raw <!subteam^ID> form when no handle can be resolved.
• Adds usergroups:read to the bot app manifest.

This does not add a synchronous lookup during connection startup or subscribe to user-group events. The first unlabeled group mention may perform one bounded lookup; cache hits do not call Slack.

Authentication impact

Cookie-backed xoxc user sessions were tested against usergroups.list successfully and do not use the bot app manifest. Existing xoxb bot installations must be reauthorized/reinstalled to grant the new usergroups:read scope.

Verification

• go test -count=1 ./pkg/connector ./pkg/msgconv/...
• go test -race -count=1 ./pkg/connector ./pkg/msgconv/...
• go vet ./pkg/connector ./pkg/msgconv/...

Tests cover embedded labels, resolved and unresolved mrkdwn mentions, rich-text user-group elements, cache hits and expiry, stale-data retention, retry backoff, and canceled contexts.